George Lambert
b4150c8250
Compose-ready workspace: packages/zappier (rate card, portal, Stripe), packages/verae-zapier-middleware (timestamp + NATS), packages/verae-zapier (CLI app), vendor/zapier-platform, and research/zapier vendor corpus. Gate 0 structure checks pass. Product code and research are not yet wired.
62 lines
7.1 KiB
XML
62 lines
7.1 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<svg xmlns="http://www.w3.org/2000/svg" width="1100" height="520"
|
|
viewBox="0 0 1100 520" role="img" aria-label="Security boundaries">
|
|
<title>Security boundaries</title>
|
|
<defs>
|
|
<marker id="arrow" viewBox="0 0 10 10" refX="9" refY="5"
|
|
markerWidth="7" markerHeight="7" orient="auto-start-reverse">
|
|
<path d="M 0 0 L 10 5 L 0 10 z" fill="#1A6B6B"/>
|
|
</marker>
|
|
<marker id="arrow-navy" viewBox="0 0 10 10" refX="9" refY="5"
|
|
markerWidth="7" markerHeight="7" orient="auto-start-reverse">
|
|
<path d="M 0 0 L 10 5 L 0 10 z" fill="#0F2744"/>
|
|
</marker>
|
|
<marker id="arrow-accent" viewBox="0 0 10 10" refX="9" refY="5"
|
|
markerWidth="7" markerHeight="7" orient="auto-start-reverse">
|
|
<path d="M 0 0 L 10 5 L 0 10 z" fill="#C2410C"/>
|
|
</marker>
|
|
</defs>
|
|
<rect width="100%" height="100%" fill="#F8FAFC"/>
|
|
<text x="24" y="28" font-family="Helvetica, Arial, sans-serif" font-size="11" font-weight="700" fill="#1A6B6B" text-anchor="start">SECURITY BOUNDARIES</text>
|
|
<text x="24" y="50" font-family="Helvetica, Arial, sans-serif" font-size="20" font-weight="700" fill="#0F2744" text-anchor="start">What is public, what stays private</text>
|
|
<rect x="20" y="80" width="1060" height="200" rx="12" fill="#FFF1E6" fill-opacity="1" stroke="#F0D2B8" stroke-width="1.4"/>
|
|
<text x="40" y="106" font-family="Helvetica, Arial, sans-serif" font-size="13" font-weight="700" fill="#C2410C" text-anchor="start">PUBLIC INTERNET</text>
|
|
<rect x="48" y="124" width="300" height="130" rx="8" fill="#FFFFFF" fill-opacity="1" stroke="#0F2744" stroke-width="1.4"/>
|
|
<text x="198" y="158" font-family="Helvetica, Arial, sans-serif" font-size="14" font-weight="700" fill="#0F2744" text-anchor="middle">Zapier cloud</text>
|
|
<text x="198" y="180" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">CLI app performs</text>
|
|
<text x="198" y="194" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">z.request only</text>
|
|
<text x="198" y="208" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">no NATS, no Verae JWT</text>
|
|
<rect x="400" y="124" width="300" height="130" rx="8" fill="#FFFFFF" fill-opacity="1" stroke="#0F2744" stroke-width="1.8"/>
|
|
<text x="550" y="158" font-family="Helvetica, Arial, sans-serif" font-size="14" font-weight="700" fill="#0F2744" text-anchor="middle">Middleware HTTPS</text>
|
|
<text x="550" y="180" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">/zapier/v1 only</text>
|
|
<text x="550" y="194" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">TLS required in prod</text>
|
|
<text x="550" y="208" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">rate limit + entitlements</text>
|
|
<rect x="752" y="124" width="300" height="130" rx="8" fill="#FFFFFF" fill-opacity="1" stroke="#0F2744" stroke-width="1.4"/>
|
|
<text x="902" y="158" font-family="Helvetica, Arial, sans-serif" font-size="14" font-weight="700" fill="#0F2744" text-anchor="middle">Zapier hook URLs</text>
|
|
<text x="902" y="180" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">untrusted egress</text>
|
|
<text x="902" y="194" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">timeouts required</text>
|
|
<text x="902" y="208" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">SSRF allowlist = Phase 15</text>
|
|
<line x1="348" y1="189" x2="400" y2="189" stroke="#1A6B6B" stroke-width="1.8" marker-end="url(#arrow)"/>
|
|
<text x="374.0" y="178.0" font-family="Helvetica, Arial, sans-serif" font-size="10" font-weight="600" fill="#134848" text-anchor="middle">HTTPS in</text>
|
|
<line x1="700" y1="189" x2="752" y2="189" stroke="#1A6B6B" stroke-width="1.8" marker-end="url(#arrow)"/>
|
|
<text x="726.0" y="178.0" font-family="Helvetica, Arial, sans-serif" font-size="10" font-weight="600" fill="#134848" text-anchor="middle">HTTPS out</text>
|
|
<rect x="20" y="300" width="1060" height="196" rx="12" fill="#F3EDE0" fill-opacity="1" stroke="#E0D2B4" stroke-width="1.4"/>
|
|
<text x="40" y="326" font-family="Helvetica, Arial, sans-serif" font-size="13" font-weight="700" fill="#B45309" text-anchor="start">PRIVATE · do not expose ports 4222 / store / TOKEN_SECRET</text>
|
|
<rect x="48" y="348" width="320" height="126" rx="8" fill="#FFFFFF" fill-opacity="1" stroke="#0F2744" stroke-width="1.4"/>
|
|
<text x="208" y="380" font-family="Helvetica, Arial, sans-serif" font-size="14" font-weight="700" fill="#0F2744" text-anchor="middle">NATS JetStream</text>
|
|
<text x="208" y="402" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">tokenRef, not raw JWT</text>
|
|
<text x="208" y="416" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">private network + auth</text>
|
|
<text x="208" y="430" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">mTLS is Phase 15</text>
|
|
<rect x="400" y="348" width="320" height="126" rx="8" fill="#FFFFFF" fill-opacity="1" stroke="#0F2744" stroke-width="1.4"/>
|
|
<text x="560" y="380" font-family="Helvetica, Arial, sans-serif" font-size="14" font-weight="700" fill="#0F2744" text-anchor="middle">Workers + file store</text>
|
|
<text x="560" y="402" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">STORE_PATH store.json</text>
|
|
<text x="560" y="416" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">single-node MVP</text>
|
|
<text x="560" y="430" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">Postgres/Redis = Phase 15</text>
|
|
<rect x="752" y="348" width="300" height="126" rx="8" fill="#FFFFFF" fill-opacity="1" stroke="#0F2744" stroke-width="1.4"/>
|
|
<text x="902" y="380" font-family="Helvetica, Arial, sans-serif" font-size="14" font-weight="700" fill="#0F2744" text-anchor="middle">api.veraetime.net</text>
|
|
<text x="902" y="402" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">Verae JWT stays here</text>
|
|
<text x="902" y="416" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">server-side login only</text>
|
|
<text x="902" y="430" font-family="Helvetica, Arial, sans-serif" font-size="12" font-weight="400" fill="#334155" text-anchor="middle">MOCK_VERAE for tests</text>
|
|
<line x1="368" y1="411" x2="400" y2="411" stroke="#1A6B6B" stroke-width="1.8" marker-end="url(#arrow)"/>
|
|
<line x1="720" y1="411" x2="752" y2="411" stroke="#1A6B6B" stroke-width="1.8" marker-end="url(#arrow)"/>
|
|
</svg>
|